Special characters break path parsing in XML functions (PHP Group PHP)
At a glance
- Source
- NVD
- EPSS
- EPSS 25.31 % · percentile 98 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- php
- NVD status
- Modified
Description
In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
Weaknesses (CWE)
- CWE-159 — Improper Handling of Invalid Use of Special Elements
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | php |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · security@php.net (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-8879
- GCVE · GCVE-0-2021-21707
CERT-FR advisories
- CERTFR-2023-AVI-0537 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2022-AVI-370 — Multiples vulnérabilités dans Tenable.sc · cert.ssi.gouv.fr
- CERTFR-2021-AVI-890 — Multiples vulnérabilités dans PHP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*≥ 7.3.0 < 7.3.33cpe:2.3:a:php:php:*:*:*:*:*:*:*:*≥ 7.4.0 < 7.4.26cpe:2.3:a:php:php:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.0.13cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*< 5.21.0
Affected products
| Product | Versions |
|---|---|
| PHP Group · PHP | affected 7.3.x < 7.3.33 ; affected 7.4.x < 7.4.26 ; affected 8.0.X < 8.0.13 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |